<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Comparto un filtro bastante granular para la routing-engine (control-plane) que estuve ideando para reducir el comportamiento de este tipo de vulnerabilidad hasta que podamos upgradear el Junos.<br><br>Si bien es para Juniper, se puede leer como pseudo-codigo para otras plataformas y traducir. Agradecido de cualquier corrección/aporte!:<br><br><span style="font-family:monospace,monospace">set groups JUNOS-HARDENING policy-options prefix-list ACL-ROUTER-IPv6-ADDRESSES apply-path "interfaces <*> unit <*> family inet6 address <*>"<br><br>set groups JUNOS-HARDENING policy-options prefix-list ACL-LINK-LOCAL-IPv6 fe80::/64<br><br>set groups JUNOS-HARDENING policy-options prefix-list ACL-MCAST-SNMA-IPv6 ff02:0:0:0:0:1:ff00::/104<br><br>set groups JUNOS-HARDENING policy-options prefix-list ACL-MCAST-ALLNODES-IPv6 ff02::1/128<br><br><br><br>show groups JUNOS-HARDENING firewall family inet6 filter accept-icmp6-nd<br><br>term ns-linklocal {<br> from {<br> source-prefix-list {<br> ACL-LINK-LOCAL-IPv6;<br> }<br> destination-prefix-list {<br> ACL-MCAST-SNMA-IPv6;<br> ACL-LINK-LOCAL-IPv6;<br> }<br> next-header icmpv6;<br> icmp-type 135;<br> hop-limit 255;<br> }<br> then {<br> count accept-icmpv6-ns;<br> accept;<br> }<br>}<br>term ns-global {<br> from {<br> source-prefix-list {<br> ACL-ROUTER-IPv6-ADDRESSES;<br> }<br> destination-prefix-list {<br> ACL-MCAST-SNMA-IPv6;<br> ACL-ROUTER-IPv6-ADDRESSES;<br> }<br> next-header icmpv6;<br> icmp-type 135;<br> hop-limit 255;<br> }<br> then {<br> count accept-icmpv6-ns;<br> accept;<br> }<br>}<br>term ns-dad {<br> from {<br> source-address {<br> ::/128;<br> }<br> destination-prefix-list {<br> ACL-MCAST-SNMA-IPv6;<br> }<br> next-header icmpv6;<br> icmp-type 135;<br> hop-limit 255;<br> }<br> then {<br> count accept-icmpv6-ns;<br> accept;<br> }<br>}<br>term na-linklocal {<br> from {<br> source-prefix-list {<br> ACL-LINK-LOCAL-IPv6;<br> }<br> destination-prefix-list {<br> ACL-LINK-LOCAL-IPv6;<br> ACL-MCAST-ALLNODES-IPv6;<br> }<br> next-header icmpv6;<br> icmp-type 136;<br> hop-limit 255;<br> }<br> then {<br> count accept-icmpv6-na;<br> accept;<br> }<br>}<br>term na-global {<br> from {<br> source-prefix-list {<br> ACL-ROUTER-IPv6-ADDRESSES;<br> }<br> destination-prefix-list {<br> ACL-ROUTER-IPv6-ADDRESSES;<br> ACL-MCAST-ALLNODES-IPv6;<br> }<br> next-header icmpv6;<br> icmp-type 136;<br> hop-limit 255;<br> }<br> then {<br> count accept-icmpv6-na;<br> accept;<br> }<br>}<br>term bad-nd {<br> from {<br> next-header icmpv6;<br> icmp-type [ 133-137 141-142 ];<br> }<br> then {<br> count no-icmpv6-bad-nd;<br> log;<br> syslog;<br> discard;<br> }<br>}</span><br><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-09-28 0:06 GMT-03:00 Ivan Chapero <span dir="ltr"><<a href="mailto:info@ivanchapero.com.ar" target="_blank">info@ivanchapero.com.ar</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Hola,</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Juniper veo que liberó ayer por lo menos para la rama recomendada en los MX un fix. </div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">En CISCO veo que sigue en categoría de bug y con un workaround manual basado en ACL:</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default"><font color="#000000" face="tahoma, sans-serif"><a href="https://quickview.cloudapps.cisco.com/quickview/bug/CSCva94139" target="_blank">https://quickview.cloudapps.ci<wbr>sco.com/quickview/bug/CSCva941<wbr>39</a></font><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Saludos.</div><div><div class="h5"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><br><div class="gmail_quote">2016-08-15 15:04 GMT-03:00 Azael Fernandez Alcantara <span dir="ltr"><<a href="mailto:afaza@unam.mx" target="_blank">afaza@unam.mx</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Buen Dia,<br>
<br>
Tambien puede servir lo comentado en la sig. liga:<br>
<br>
<a href="https://www.insinuator.net/2016/05/cve-2016-1409-ipv6-ndp-dos-vulnerability-in-cisco-software/" rel="noreferrer" target="_blank">https://www.insinuator.net/201<wbr>6/05/cve-2016-1409-ipv6-ndp-do<wbr>s-vulnerability-in-cisco-softw<wbr>are/</a><br>
<br>
<br>
SALUDOS<br>
_______<br>
Azael<br>
____________________________<br>
Mensaje enviado sin acentos<div><div><br>
<br>
<br>
On Sun, 14 Aug 2016, Fernando Gont wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
FYI.<br>
<br>
Aparentemente, algunos dispositivos no descartan los paquetes de ND<br>
recibidos cuando el Hop Limit != 255.<br>
<br>
Esto, sumado a que implementar "ARP" sobre IP (como es el caso de ND)<br>
permite que dicho trafico sea ruteable, lleva a cosas como estas.<br>
<br>
En fin...<br>
<br>
<br>
-------- Forwarded Message --------<br>
Subject: CVE-2016-1409: IPv6 Neighbor Discovery Crafted Packet Denial of<br>
Service Vulnerability<br>
Date: Wed, 10 Aug 2016 17:52:16 +0000<br>
From: Suresh Krishnan <<a href="mailto:suresh.krishnan@ericsson.com" target="_blank">suresh.krishnan@ericsson.com</a>><br>
To: IETF IPv6 Mailing List <<a href="mailto:ipv6@ietf.org" target="_blank">ipv6@ietf.org</a>>, IPv6 Operations<br>
<<a href="mailto:v6ops@ops.ietf.org" target="_blank">v6ops@ops.ietf.org</a>>, <a href="mailto:6man-chairs@ietf.org" target="_blank">6man-chairs@ietf.org</a> <<a href="mailto:6man-chairs@ietf.org" target="_blank">6man-chairs@ietf.org</a>>,<br>
<a href="mailto:v6ops-chairs@ietf.org" target="_blank">v6ops-chairs@ietf.org</a> <<a href="mailto:v6ops-chairs@ietf.org" target="_blank">v6ops-chairs@ietf.org</a>><br>
<br>
Hi all,<br>
I have been notified about this vulnerability and have been asked<br>
whether this is due to an issue with the IPv6 protocol specifications.<br>
At first glance, I have a hard time seeing how this attack is possible<br>
on any compliant RFC4861 implementation given that the 255 Hop Limit<br>
check would drop any remote attack packets. If someone on the 6man/v6ops<br>
mailing lists has further info, can you please contact me off-list. My<br>
goal is to figure out if there is any protocol work or operational<br>
guidance needed from the IETF side.<br>
<br>
More info:<br>
<br>
This is the CVE list entry in question<br>
<br>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1409" rel="noreferrer" target="_blank">https://cve.mitre.org/cgi-bin/<wbr>cvename.cgi?name=CVE-2016-1409</a><br>
<br>
The Cisco security advisory<br>
<br>
<a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160525-ipv6" rel="noreferrer" target="_blank">https://tools.cisco.com/securi<wbr>ty/center/content/CiscoSecurit<wbr>yAdvisory/cisco-sa-20160525-ip<wbr>v6</a><br>
<br>
The Juniper knowledge base entry<br>
<br>
<a href="https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10749&cat=SIRT_1&actp=LIST" rel="noreferrer" target="_blank">https://kb.juniper.net/InfoCen<wbr>ter/index?page=content&id=JSA1<wbr>0749&cat=SIRT_1&actp=LIST</a><br>
<br>
Thanks<br>
Suresh<br>
<br>
------------------------------<wbr>------------------------------<wbr>--------<br>
IETF IPv6 working group mailing list<br>
<a href="mailto:ipv6@ietf.org" target="_blank">ipv6@ietf.org</a><br>
Administrative Requests: <a href="https://www.ietf.org/mailman/listinfo/ipv6" rel="noreferrer" target="_blank">https://www.ietf.org/mailman/l<wbr>istinfo/ipv6</a><br>
------------------------------<wbr>------------------------------<wbr>--------<br>
<br>
______________________________<wbr>_________________<br>
LACTF mailing list<br>
<a href="mailto:LACTF@lacnic.net" target="_blank">LACTF@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lactf" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailma<wbr>n/listinfo/lactf</a><br>
Cancelar suscripcion: <a href="mailto:lactf-unsubscribe@lacnic.net" target="_blank">lactf-unsubscribe@lacnic.net</a><br>
<br>
</blockquote>
______________________________<wbr>_________________<br>
LACTF mailing list<br>
<a href="mailto:LACTF@lacnic.net" target="_blank">LACTF@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lactf" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailma<wbr>n/listinfo/lactf</a><br>
Cancelar suscripcion: <a href="mailto:lactf-unsubscribe@lacnic.net" target="_blank">lactf-unsubscribe@lacnic.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><b>Ivan Chapero<br><span style="color:rgb(102,102,102)">Área Técnica y Soporte</span></b><span style="color:rgb(102,102,102)"> </span><br style="color:rgb(102,102,102)"><span style="color:rgb(102,102,102)">Fijo: 03464-470280 (interno 535)</span> | <span style="color:rgb(102,102,102)">Móvil: 03464-155-20282</span> | <span style="color:rgb(102,102,102)">Skype ID: ivanchapero</span><div><span style="color:rgb(102,102,102)">--</span><br style="color:rgb(102,102,102)"><div style="text-align:center"><span style="color:rgb(102,102,102)">GoDATA Banda Ancha - CABLETEL S.A. | Av. 9 de Julio 1163 - 2183 - Arequito - Santa Fe - Argentina</span></div><br><br><br><br><br><br><br></div></div></div>
</font></span></div></div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Ivan Chapero<br><span style="color:rgb(102,102,102)">Área Técnica y Soporte</span></b><span style="color:rgb(102,102,102)"> </span><br style="color:rgb(102,102,102)"><span style="color:rgb(102,102,102)">Fijo: 03464-470280 (interno 535)</span> | <span style="color:rgb(102,102,102)">Móvil: 03464-155-20282</span> | <span style="color:rgb(102,102,102)">Skype ID: ivanchapero</span><div><span style="color:rgb(102,102,102)">--</span><br style="color:rgb(102,102,102)"><div style="text-align:center"><span style="color:rgb(102,102,102)">GoDATA Banda Ancha - CABLETEL S.A. | Av. 9 de Julio 1163 - 2183 - Arequito - Santa Fe - Argentina</span></div><br><br><br><br><br><br><br></div></div></div>
</div>